General

Malware Config

Signatures

Files

• e008d7bb6343bc6424be5a2a4515a07c8a60d17bfb5a8653ab74822e585f03b6

  .exe windows x86

  6fe1a71a390c8ad376ecc9d5cc58c394

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  normaliz

  IdnToAscii

  wldap32

  ord217

  ord46

  ord211

  ord60

  ord45

  ord50

  ord41

  ord22

  ord26

  ord27

  ord32

  ord33

  ord35

  ord79

  ord30

  ord200

  ord301

  ord143

  crypt32

  CertFreeCertificateChain

  CertGetCertificateChain

  CertFreeCertificateChainEngine

  CertCreateCertificateChainEngine

  CryptQueryObject

  CertGetNameStringA

  CertFindExtension

  CertAddCertificateContextToStore

  CryptDecodeObjectEx

  PFXImportCertStore

  CryptStringToBinaryA

  CertOpenStore

  CertCloseStore

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertFreeCertificateContext

  advapi32

  CryptHashData

  CryptEncrypt

  CryptImportKey

  CryptDestroyKey

  CryptDestroyHash

  CryptAcquireContextA

  CryptCreateHash

  CryptGetHashParam

  CryptGenRandom

  CryptReleaseContext

  kernel32

  CreateProcessA

  SetStdHandle

  HeapReAlloc

  HeapSize

  GetTimeZoneInformation

  FindFirstFileExA

  FindNextFileA

  GetExitCodeProcess

  IsValidCodePage

  GetOEMCP

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  GetProcessHeap

  WriteConsoleW

  SetEndOfFile

  CreateDirectoryW

  GetLogicalDrives

  FindFirstFileW

  Process32First

  FindNextFileW

  TerminateProcess

  GetDriveTypeA

  FindClose

  OpenProcess

  CreateToolhelp32Snapshot

  Process32Next

  CloseHandle

  FreeConsole

  lstrcmpW

  GetLastError

  SetLastError

  QueryPerformanceCounter

  QueryPerformanceFrequency

  GetCurrentThread

  GetThreadTimes

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionEx

  DeleteCriticalSection

  SleepEx

  GetSystemDirectoryA

  FreeLibrary

  GetModuleHandleA

  GetProcAddress

  LoadLibraryA

  GetTickCount

  Sleep

  MultiByteToWideChar

  WideCharToMultiByte

  MoveFileExA

  WaitForSingleObjectEx

  GetEnvironmentVariableA

  GetStdHandle

  GetFileType

  ReadFile

  PeekNamedPipe

  WaitForMultipleObjects

  FormatMessageA

  VerSetConditionMask

  VerifyVersionInfoA

  CreateFileA

  GetFileSizeEx

  FlushFileBuffers

  HeapFree

  HeapAlloc

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetConsoleCP

  ReadConsoleW

  GetConsoleMode

  GetACP

  GetCommandLineW

  GetCommandLineA

  WriteFile

  GetModuleFileNameA

  SetFilePointerEx

  ExitThread

  FileTimeToSystemTime

  SystemTimeToTzSpecificLocalTime

  GetDriveTypeW

  GetModuleHandleExW

  ExitProcess

  RaiseException

  RtlUnwind

  WaitForSingleObject

  LoadLibraryW

  UnregisterWaitEx

  QueryDepthSList

  InterlockedFlushSList

  GetCurrentDirectoryW

  CreateFileW

  DeleteFileW

  FindFirstFileExW

  GetDiskFreeSpaceExW

  GetFileAttributesExW

  GetFileInformationByHandle

  GetFullPathNameW

  AreFileApisANSI

  GetModuleHandleW

  MoveFileExW

  FormatMessageW

  GetStringTypeW

  TryEnterCriticalSection

  GetCurrentThreadId

  DuplicateHandle

  GetCurrentProcess

  SwitchToThread

  GetExitCodeThread

  InitializeCriticalSectionAndSpinCount

  CreateEventW

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  EncodePointer

  DecodePointer

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  GetCPInfo

  SetEvent

  ResetEvent

  InitializeSListHead

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetStartupInfoW

  GetCurrentProcessId

  CreateTimerQueue

  SignalObjectAndWait

  CreateThread

  SetThreadPriority

  GetThreadPriority

  GetLogicalProcessorInformation

  CreateTimerQueueTimer

  ChangeTimerQueueTimer

  DeleteTimerQueueTimer

  GetNumaHighestNodeNumber

  GetProcessAffinityMask

  SetThreadAffinityMask

  RegisterWaitForSingleObject

  UnregisterWait

  FreeLibraryAndExitThread

  GetModuleFileNameW

  LoadLibraryExW

  GetVersionExW

  VirtualAlloc

  VirtualProtect

  VirtualFree

  ReleaseSemaphore

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  ws2_32

  getaddrinfo

  ntohl

  inet_ntoa

  inet_addr

  closesocket

  getsockname

  connect

  socket

  setsockopt

  gethostname

  freeaddrinfo

  ioctlsocket

  htons

  WSAStartup

  WSACleanup

  WSAGetLastError

  getpeername

  ntohs

  recv

  select

  send

  bind

  getsockopt

  WSASetLastError

  WSAIoctl

  accept

  listen

  __WSAFDIsSet

  sendto

  recvfrom

  htonl

  Sections

  .text

  Size: 1003KB - Virtual size: 1002KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 223KB - Virtual size: 222KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 27KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 56KB - Virtual size: 55KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ